- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI,
I am new to Splunk. If criteria is met, I notice my search results include my previous searches stored in Splunk's own audit trail. They have:
host = [one of the Splunk nodes]
source = audittrail
sourcetype = audittrail
Is there a way to exclude it? It generates a lot of noise when I am refining my searches.. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
That will happen if you specify index=_audit in your query. Don't do that if you don't want to see that data.
It also will happen if your default indexes list includes _* or _audit and you don't specify index name(s) in your query. Don't do that. Always include at least one index name in your queries (with few exceptions).
Or specifically exclude that source(type) in your query.
blah blah source!=audittrail blah blah
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
That will happen if you specify index=_audit in your query. Don't do that if you don't want to see that data.
It also will happen if your default indexes list includes _* or _audit and you don't specify index name(s) in your query. Don't do that. Always include at least one index name in your queries (with few exceptions).
Or specifically exclude that source(type) in your query.
blah blah source!=audittrail blah blah
If this reply helps you, Karma would be appreciated.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)